The policies on valid SAP authorizations have been changed. Now the new policies must be checked to see if existing authorizations comply. SAP roles and user accounts with invalid combinations of authorizations must be identified so that they can be modified to meet the new requirements.

An SAP function is created for each invalid authorization combination.

Table 2: Example of an authorization definition

SAP function	Function argument	Authorization objects	Field	Value
F-A	D1	S_TCODE	TCD	TR1,TR2
	D2	AO2	NAME	*
	D3	AO3	ACTVT	04
	D3	AO3	NAME	H_XYZ
	D4	AO3	ACTVT	04
	D4	AO3	NAME	R*
Condition:	D1 AND D2 AND (D3 OR D4)
F-B	D1	S_TCODE	TCD	TR3
	D2	S_TCODE	TCD	TR4,TR5
	D3	AO4	ACTVT	02
	D3	AO4	NAME	G
	D4	AO4	ACTVT	02
	D4	AO4	NAME	*
Condition:	(D1 AND D3) OR (D2 AND D4)

The following SAP roles are available:

Table 3: Defined SAP roles

SAP role	Authorization objects	Field	Value
R1	AO1	ACTVT	*
	AO1	NAME	*
	AO2	NAME	GEF*
	AO3	ACTVT	*
	AO3	NAME	H_XYZ
	S_TCODE	TCD	TR1
R2	AO2	NAME	*
	AO3	ACTVT	01, 02, 04
	AO3	NAME	R_ST
	S_TCODE	TCD	TR4
R3	AO3	ACTVT	04
	AO3	NAME	H_XYZ
	AO4	ACTVT	02, 03
	AO4	NAME	*
	S_TCODE	TCD	TR6
R4	AO4	ACTVT	02
	AO4	NAME	*
	S_TCODE	TCD	TR3

The composite role R5 is assigned the single roles R2 and R3.

Table 4: Defined composite role

SAP role	Authorization objects	Field	Value
R5 has the following authorizations via the single roles R2 and R2	AO2	NAME	*
	AO3	ACTVT	01, 02, 04
	AO3	NAME	R_ST
	S_TCODE	TCD	TR4
	AO3	ACTVT	04
	AO3	NAME	H_XYZ
	AO4	ACTVT	02, 03
	AO4	NAME	*
	S_TCODE	TCD	TR6

The following user accounts are available:

• User account AC1 with composite role R5

• User account AC2 with SAP roles R2 and R3

  AC2 then has the same authorizations as AC1.

• User account AC3 with the SAP role R2

• User account AC4 with the SAP role R3

The authorization check determines all SAP roles and user accounts that are assigned the authorization objects and values listed in the authorization definitions. These roles and user accounts match the SAP functions. The authorization check produces the following results if the TargetSystem | SAPR3 | SAPRights | TestWithoutTCD configuration parameter is set.

Table 5: Authorization check results

Roles and user accounts	SAP function F-A	SAP function F-B
R1	match The role fulfills the condition D1 AND D2 AND D3.	no match
R2	no match	no match
R3	no match	no match
R4	no match	match The role fulfills the condition D1 AND D3.
R5	no match	match The role fulfills the condition D2 AND D4.
AC1	no match	match The user account fulfills the condition D2 AND D4.
AC2	no match	match The user account fulfills the condition D2 AND D4.
AC3	no match	no match
AC4	no match	no match

The SAP roles R1 and R4 and the composite role R5 as well as the user accounts AC1 and AC2 so not comply with the new policies and must be adjusted.

The authorization check ignores the authorization object S_TCODE if the TargetSystem | SAPR3 | SAPRights | TestWithoutTCD is set. The following conditions therefore apply to the test:

• F-A: D2 AND (D3 OR D4)

• F-B: D3 OR D4

Table 6: Results of the authorization check if TestWithoutTCD is set

Roles and user accounts	SAP function F-A	SAP function F-B
R1	match The role fulfills the condition D2 AND D3.	no match
R2	match The role fulfills the condition D2 AND D4.	no match
R3	no match	match The role fulfills the condition D3 OR D4.
R4	no match	match The role fulfills the condition D3 OR D4.
R5	match The role fulfills the condition D2 AND D3 as well as D2 AND D4.	match The role fulfills the condition D3 OR D4.
AC1	match The user account fulfills the condition D2 AND D3 as well as D2 AND D4.	match The user account fulfills the condition D3 OR D4.
AC2	match The user account fulfills the condition D2 AND D3 as well as D2 AND D4.	match The user account fulfills the condition D3 OR D4.
AC3	match The user account fulfills the condition D2 AND D4.	no match
AC4	no match	match The user account fulfills the condition D3 OR D4.

If the TestWithoutTCD configuration parameter is set for the authorization check, then all SAP roles and user accounts match at least one SAP function and therefore do not comply with the new policies.

Example using different technical profiles

The decisive factor for the authorization check is whether a profile with multiple technical profiles belongs to one SAP role. The authorization check determines whether all the function elements and their values defined for an authorization object occur in a technical profile. If the authorization object has different values in different technical profiles, the SAP function does not find the role. The following example shows the difference.

Table 7: Defined SAP roles with technical profiles

SAP role	Authorization objects	Field	Value	Technical profile
R6	AO1	ACTVT	02, 03	TP1
	AO1	NAME	*
	S_TCODE	TCD	TR1, TR2
R7	AO1	ACTVT	02	TP2
	AO1	NAME	*
	S_TCODE	TCD	TR2
	AO1	ACTVT	03	TP3
	AO1	NAME	Z*
	S_TCODE	TCD	TR1

Table 8: Authorization definition

SAP function	Function argument	Authorization objects	Field	Value
F-TP1	D1	S_TCODE	TCD	TR1
	D1	S_TCODE	TCD	TR2
	D2	AO1	NAME	*
	D3	AO1	ACTVT	02
	D3	AO1	ACTVT	03
Condition:	(D1 AND D2) OR (D2 AND D3)

Results of the authorization check if the TestWithoutTCD configuration parameter is not set:

• The SAP role R6 matches the SAP function because the technical profile TP1 fulfills the condition.

• The SAP role R7 does not match the SAP function because S_TCODE with the value TR1 and S_TCODE with the value TR2 belong to different technical profiles. BO1 with the value 02 and BO1 with the value 03 also belong to different technical profiles.

• The role R7 is also found by making the following adjustment to the SAP function:

  Table 9: Authorization definition

  SAP function	Function argument	Authorization objects	Field	Value
  F-TP2	D1	S_TCODE	TCD	TR1
  	D2	S_TCODE	TCD	TR2
  	D3	AO1	NAME	*
  	D4	AO1	ACTVT	02
  	D5	AO1	ACTVT	03
  Condition:	(D1 AND D2 AND D3) OR (D3 AND D4 AND D5)

Related topics

• Example of identities with invalid SAP authorizations
• Examples of SAP functions